GCVE-110-OSM-2026-1245

Dependency confusion package targeting the Xiaomi (YouPin marketplace)'s internal 'youpin-pc' namespace. At install time, the preinstall script (callback.js) exfiltrates a 28-field host fingerprint — hostname, username, user ID, working directory, home dir, OS platform/arch/release/type, CPU count, total/free memory, uptime, all network interface details (names, MAC addresses, IPs) via os.networkInterfaces(), full 'ip a' output, PATH/HOME/USER/SHELL/CI/DOCKER/HOSTNAME env vars, /etc/resolv.conf DNS server list, and Node.js version — to attacker-controlled OAST domain ienfcixqbgvbxkccdoxg5q7izv7jm498k.oast.fun via DNS subdomain encoding and HTTPS POST. Version 99.x.x is used to win dependency confusion races against internal packages. One of 3 packages in the same campaign: mi-account, youpin. package.json declares 'preinstall: node callback.js'. callback.js collects 28 fields (see data_exfiltrated), JSON-serialises, base64-encodes. DNS exfil: dns.resolve('yppc.<60-char-b64-prefix>.ienfcixqbgvbxkccdoxg5q7izv7jm498k.oast.fun'). HTTPS POST to https://ienfcixqbgvbxkccdoxg5q7izv7jm498k.oast.fun/youpin-pc with Content-Type: application/json. Falls back to HTTP port 80 on TLS failure. All 7 packages in the r76o4 campaign use the same callback.js template; only the CALLBACK_DOMAIN, package name, DNS prefix, and POST path differ.